Overview

overview

7

Static

static

3

6eb34a8bf4...a9.exe

windows10-2004-x64

7

6eb34a8bf4...a9.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 22:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
  • Size 4.1MB
  • Sample261002-2g47saxtcv
  • SHA256 6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC65.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE4A.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4204
          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3844
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC232.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5088
              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4820
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4B2.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3808
                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2380
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC781.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3264
                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:4988
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA8E.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:2240
                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:5012
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC82.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2164
                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1580
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD02C.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1872
                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:3468
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD368.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3064
                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:920
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9E0.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4580
                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:2264
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCEE.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4428
                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:1876
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF9D.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:976
                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4260
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE644.bat
                                                      26⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3976
                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1720
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE71F.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2536
                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1100
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA7A.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2036
                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4616
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC7E.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4308
                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4928
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF4D.bat
                                                                      34⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1080
                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2332
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF20C.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4852
                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3492
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF42F.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3380
                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1156
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF690.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4744
                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1980
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF73C.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2712
                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4032
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7E8.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4984
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4952
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF874.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4196
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3412
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8F1.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4964
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4668
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC5C.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2428
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:416
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD08.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1328
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4152
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD95.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2084
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3320
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE12.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2272
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2624
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE8F.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4672
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4872
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF2B.bat
                                                                                                                          60⤵
                                                                                                                            PID:3496
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:4476
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73.bat
                                                                                                                                62⤵
                                                                                                                                • Executes a command shell one-liner
                                                                                                                                PID:1428
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:5072
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AC.bat
                                                                                                                                    64⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4568
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:2792
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a238.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:1424
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4460
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C5.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:1056
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4828
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a352.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:4180
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4232
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EE.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:4584
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:2752
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47B.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:2376
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1128
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a517.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:2852
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:1016
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A3.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:1544
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:2304
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a630.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:2340
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:2236
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BD.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                    PID:2796
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3604
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73A.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1000
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:4124
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B7.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4132
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:2212
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a843.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                  PID:4036
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D0.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:564
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:548
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:368
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:4312
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA08.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:1628
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA5.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:1784
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2864
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBED.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3676
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6A.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                  PID:4108
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:536
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:3452
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2736
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC2.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:4380
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3F.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:2988
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:1704
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDB.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2412
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4712
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1004.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3620
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4404
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10B0.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a115B.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4300
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3608
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11D8.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3704
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    PID:4340
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1275.bat
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:1540
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12F2.bat
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:860
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            PID:4184
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a137E.bat
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:1476
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:1464
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a143A.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  PID:4288
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:4400
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14D6.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:4648
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                          PID:1840
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1582.bat
                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5052
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a163D.bat
                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:4824
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:5092
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1747.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                      PID:868
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                          PID:3164
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1822.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:4344
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a190C.bat
                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:2908
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                    PID:688
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19F7.bat
                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                        PID:4144
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                          141⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AA2.bat
                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:2600
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:4440
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B3F.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                  PID:4068
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BDB.bat
                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                      PID:3396
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:2508
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C77.bat
                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                          PID:540
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:3444
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D33.bat
                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:928
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DBF.bat
                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:4332
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:1204
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E5C.bat
                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EF8.bat
                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1516
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2030.bat
                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4020
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a214A.bat
                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4740
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4632
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2215.bat
                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:2384
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3424
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22E0.bat
                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4676
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a237C.bat
                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:840
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4248
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2476.bat
                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2541.bat
                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                      PID:812
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a266A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a289D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2958.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ACF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B6B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C17.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D5F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FE0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a306D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3118.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a328F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a333B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3464.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3500.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a358D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a360A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3733.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                              32⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                              PID:4480
                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                33⤵
                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                PID:1804
                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                  34⤵
                                                                                                                                                                    PID:1784
                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                    C:\Windows\Logo1_.exe
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Enumerates connected drives
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Drops file in Windows directory
                                                                                                    • Reads the TCP/IP host and domain name from the registry
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4484
                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                      3⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2220
                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                        4⤵
                                                                                                          PID:2088
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 972
                                                                                                        3⤵
                                                                                                        • Program crash
                                                                                                        PID:4440
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4484 -ip 4484
                                                                                                    1⤵
                                                                                                      PID:1552

                                                                                                    Network

                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          $$aBC65.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBC65.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 ba10c5a1d820b608b5f07a20705502816752d74825921833e29a44f16dc4ca8a
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aBE4A.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBE4A.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 eeec6adf66c2aeb9efc78f5603039ff5e32683c7eba895f659ad6710ba5830ce
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aC232.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC232.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 df72bebe4633fbe00bc8ab6e1e817ac4300add4ed07659b70750e09b60f78057
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aC4B2.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC4B2.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 5e0ee269a666e8fdd653c71e04180e010d72e0acfba1ac986b9ff84c2d5b9b28
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aC781.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC781.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 f705f921d6430dfa6cd18a012707cd4b73f48451cafbdcd78232dd96fd02bfe6
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aCA8E.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCA8E.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 d16b372239db707c04e3b4d7529e85b82b131de36f39ca5e3d698e6312405a10
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aCC82.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCC82.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 d2cc1904e19bbc6089f08b957688aa04a2738fef6f7b45a6475668245d50251b
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aD02C.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD02C.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 1f9d634be750909e420acf9bf2b0a31cf84c3f9a62c88e7755f0d9131512593e
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aD368.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD368.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 477946c3e8de0fbee1fb8729bd75e4e22656f3176ae44e6d052ac37c5798d451
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aD9E0.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD9E0.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 e152803c2b41672144c6d74e0a5390f67874aff65c75c78d15acae6b129f5df4
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aDCEE.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aDCEE.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 175a2615887cd1e1de5606c298f8a8c46e451f5880d7b6882a0d1245bea807b7
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aDF9D.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aDF9D.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 5117a088213e1f531af53944dcd33d736aa3e825bfbe59d41855ead803dc2669
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aE644.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE644.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 4444850ec83d6d902412ba62852f1ecaf3abccd4c85b1f60ec3a6c155e90e54a
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aE71F.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE71F.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 6f42bc288358237296351aad4e73524b2e66100c18cf1472e2372a43454aed33
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aEA7A.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEA7A.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 7eb59bbc30a8bb514008c641b618de9a1ea35c4cb836ed884d963d0188e3db10
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aEC7E.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEC7E.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 e1590742550ecbb8479b70f00a1562620fe99207fd3479073e731b375dea0f58
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aEF4D.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEF4D.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 6b95c1d94f2956721d74f0fb9bf49cb7f88c4c6bc31832d1f7d0b0180c2bb58f
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          $$aF20C.bat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF20C.bat
                                                                                                          • Size 722B
                                                                                                          • SHA256 f0530cdbe1ec2d033bfd56948f463b60ca0828bbddda11e81348ffce55c6b5c6
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe
                                                                                                          • Size 4.0MB
                                                                                                          • SHA256 9c1b320c30bf7e47135f29657ef082d14f13d43c129a9ea14df59c84a1b49831
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.8MB
                                                                                                          • SHA256 45c0c9f16e1dc708ad293707d9337af4a66042b6c293c61ba34199b2ec943a77
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.8MB
                                                                                                          • SHA256 e9c0310c19951d7142b603a158386297efe33bd36c206e5de152805db6844d2f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.7MB
                                                                                                          • SHA256 d7b9d967d88d6c945ffd5bef5d7fefa441f6cd43a97ccadcac73513993e805d5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 4.1MB
                                                                                                          • SHA256 99dfd795735ebfccd85a21275727d0edd623cc1c19b276cb73b09ed9de53bfb3
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 4.0MB
                                                                                                          • SHA256 ae7acb0522954079347376a179678372e74044ce1ce04214f50b0c7c7b513cdc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.7MB
                                                                                                          • SHA256 5463e3478580e7c5db0112d033f5735aa7dd78c1d4d56abee4e57be6a1f01630
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.7MB
                                                                                                          • SHA256 53cc17f668fc08a983d28debd5658442d23649ad239d005f92e86274d3583e07
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.6MB
                                                                                                          • SHA256 007a7ad1756eceae36cbf3de3bad53f125d0692ae5f0f4599115aaa55018856e
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 4.0MB
                                                                                                          • SHA256 7cb50bb64ffc814882a986c590091f0f2358f810608a3288f14ff65b5197f599
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.6MB
                                                                                                          • SHA256 bb03d605b6ad2ea56b0d7627ee290270395b6fe87c3fc5cd3a4743ab78ccc1a4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.5MB
                                                                                                          • SHA256 dba296bc5adba6bf2f03f0593e9bc2b605ae86c1625576f963cd68ce7f7b57e5
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.9MB
                                                                                                          • SHA256 98673ea762606f364f126057f13ff87f2edf350a45b8e4d17791bbcec35587e9
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.9MB
                                                                                                          • SHA256 bedf0d0756acb1e8c2e0dbbcac6a89c068fd96a51c48dfb75e2d62a8fad64d86
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.6MB
                                                                                                          • SHA256 b27fc435b303130bfb26050cc63b6fc77cfa058d755e45ee1d02fe94d313e5b6
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.9MB
                                                                                                          • SHA256 a6c58e15a0daa8593cd5ab97435d70cde0ca9a00d8f6b3cc2e767b28ef93fa7c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.8MB
                                                                                                          • SHA256 3a1b910d79983762a86521f868d0f712fe7e79c6596bcc5d2f7248341b8dad9b
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6eb34a8bf4db036bdff2fe35cb15df5ed5fe6fdf899574667882da0c5f5b9ea9.exe.exe
                                                                                                          • Size 3.5MB
                                                                                                          • SHA256 180d23aa7b97ff908dd09f94d6f4dd1cf0f77019d2cae1fa289ccfa3a995aabc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Dll.dll
                                                                                                          • Path C:\Windows\Dll.dll
                                                                                                          • Size 68KB
                                                                                                          • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Logo1_.exe
                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                          • Size 32KB
                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          _desktop.ini
                                                                                                          • Path F:\$RECYCLE.BIN\_desktop.ini
                                                                                                          • Size 9B
                                                                                                          • SHA256 66c5371c302c0168792bdad2070b6db71275df5a2ac194c19d038c7fdde2b7d6
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          memory/396-2904-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/416-2573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/436-2946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/536-2703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/548-2673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/552-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/688-2802-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/864-3021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/920-1655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/928-2838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1016-2638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1076-3015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1100-2493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1128-2633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1152-3009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1156-2542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1204-2844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1392-2688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1464-2760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1468-3003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1492-2940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1540-2748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1580-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1628-2683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1648-2934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1704-2718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1708-3033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1720-2439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1772-2991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1840-2772-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1876-1873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1980-2547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2056-2668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2080-2862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2184-3065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2184-3070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2212-2663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2236-2648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2260-2970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2264-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2268-2880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2304-2643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2332-2525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2380-54-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2508-2826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2520-2916-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2624-2588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2684-2982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2716-2856-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2736-2708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2752-2628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2792-2608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2864-2693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2984-2898-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3128-3027-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3140-2952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3164-2790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3204-2964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3320-2583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3412-2562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3424-2874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3444-2832-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3468-126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3492-2535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3532-3039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3604-2653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3608-2738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3668-2808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3676-2698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3844-31-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3848-2820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3916-2922-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3936-2892-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4032-2552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4112-2976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4124-2658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4152-2578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4172-2928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4184-2753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4232-2623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4248-2886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4260-2431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4312-2678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4340-2743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4356-2997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4380-2713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4400-2766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4404-2728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4412-2988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4440-2814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4452-3045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4460-2613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4476-2598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4480-2569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4480-2505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4480-2755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4484-1651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4484-2427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4484-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4484-2485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4556-2910-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4592-2850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4616-2507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4632-2868-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4656-3063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4668-2567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4712-2723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4764-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4764-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4780-2733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4820-40-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4828-2618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4872-2593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4928-2517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4952-2557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4988-66-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5012-74-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5016-3051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5020-2796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5052-2778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5064-3057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5072-2603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5084-2958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download

                                                                                                          memory/5092-2784-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                          Download